{
  "deliveryId": "0ed43984-8494-4536-b3f0-aa227f435af0",
  "eventId": "8e9e30d5-9934-406a-842c-a38e06ce4443",
  "eventType": "horse.report.group.created",
  "occurredAt": "2026-07-30T04:00:00Z",
  "accountId": 1234,
  "data": {
    "accountId": 1234,
    "id": 5678,
    "type": "GROUP_UPDATE",
    "title": "Weekly stable update",
    "status": "PUBLISHED",
    "publishDate": "2026-07-30T04:00:00Z",
    "reportCount": 2,
    "reports": [
      {
        "id": 55101,
        "horseId": 42,
        "horseName": "Winx"
      },
      {
        "id": 55102,
        "horseId": 43,
        "horseName": "Black Caviar"
      }
    ]
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();

const SIGNING_SECRET = process.env.PRISM_WEBHOOK_SECRET!; // whsec_… from Integration → Webhook
const TOLERANCE_SECONDS = 5 * 60;                          // reject very old / future timestamps

/**
 * IMPORTANT: express.raw() — the signature covers the RAW body bytes.
 * express.json() would give you a parsed object, and re-serialising it changes
 * whitespace and key order, so the signature would never match.
 */
app.post('/webhooks/prism', express.raw({ type: 'application/json' }), (req, res) => {
  const signatureHeader = req.header('X-Prism-Signature');        // "sha256=<hex>"
  const timestamp = req.header('X-Prism-Signature-Timestamp');    // unix SECONDS
  const rawBody = req.body as Buffer;

  if (!signatureHeader || !timestamp) {
    return res.status(400).send('missing signature headers');
  }

  // 1. Reject stale timestamps — this is what stops a captured request being replayed.
  const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));

  if (!Number.isFinite(ageSeconds) || ageSeconds > TOLERANCE_SECONDS) {
    return res.status(400).send('stale timestamp');
  }

  // 2. Recompute: HMAC-SHA256 over "<timestamp>." + rawBody, keyed with the secret.
  const expected = crypto
    .createHmac('sha256', SIGNING_SECRET)
    .update(timestamp + '.')
    .update(rawBody)
    .digest('hex');

  const received = signatureHeader.replace(/^sha256=/, '');

  // 3. Constant-time compare. timingSafeEqual throws on length mismatch, so guard first.
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(received, 'utf8');
  const valid = a.length === b.length && crypto.timingSafeEqual(a, b);

  if (!valid) {
    return res.status(401).send('bad signature');
  }

  const event = JSON.parse(rawBody.toString('utf8'));

  // 4. The verification handshake: answer 200 and you are switched to ACTIVE.
  //    Until that happens Prism sends no product events at all.
  if (event.eventType === 'webhook.verification') {
    return res.sendStatus(200);
  }

  // 5. Acknowledge FAST, then work. Prism gives you 10 seconds before it counts a timeout.
  res.sendStatus(200);

  // 6. Delivery is at-least-once: the same deliveryId can arrive again after a retry.
  void handleEvent(event).catch(err => console.error('[prism] handler failed', err));
});

const seenDeliveries = new Set<string>(); // use Redis/DB in production, not memory

async function handleEvent(event: {
  deliveryId: string;
  eventType: string;
  accountId: number;
  data: Record<string, unknown>;
}) {
  if (seenDeliveries.has(event.deliveryId)) return; // idempotency
  seenDeliveries.add(event.deliveryId);

  // Switch on eventType, never on the module: one module can deliver more than one payload shape.
  switch (event.eventType) {
    case 'horse.report.group.created': {
      // A group update: one event carrying every report in the group.
      const { id, reportCount, reports } = event.data as {
        id: number;
        reportCount: number;
        reports: { id: number; horseId: number; horseName: string }[];
      };

      console.log(`group ${id}: ${reportCount} reports`, reports.map(r => r.horseName));
      break;
    }

    case 'task.trackwork.created':
      console.log('new trackwork', event.data);
      break;

    default:
      console.log('unhandled event', event.eventType);
  }
}

app.listen(3000);